CVE-2026-81429

The Export & Import WPBakery Page Builder WordPress plugin through version 1.0.2 fails to implement CSRF protections on its template-import feature and does not sanitize imported data before storing and echoing it back. An attacker can trick a logged-in administrator into importing a maliciously crafted template via a forged request (e.g., through a link or embedded image on a site the admin visits). Because the malicious content is stored and rendered in the administrator's session, the attacker gains the ability to execute arbitrary JavaScript with admin privileges, which can be leveraged for site takeover, malicious admin creation, or further payload injection. Any WordPress site running this plugin at or below version 1.0.2 with an active administrator is affected. No public proof-of-concept or observed in-the-wild exploitation is known at this time, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: No fixed version is indicated in the available data, so treat all versions through 1.0.2 as vulnerable; disable and remove the plugin if the template export/import functionality is not essential. If the functionality is required, restrict access to trusted administrators only, audit previously imported templates for unexpected script content, and check WordPress user lists for recently created rogue admin accounts. As a general defense, administrators should avoid visiting untrusted sites while logged in, since the attack requires a forged request from the admin's browser.